---
source_url: https://www.pubnub.com/docs/sdks/swift/api-reference/encryption
title: Encryption API for Swift Native SDK
updated_at: 2026-05-18T12:51:31.912Z
sdk_name: PubNub Swift SDK
sdk_version: 10.1.6
---

> Documentation Index
> For a curated overview of PubNub documentation, see: https://www.pubnub.com/docs/llms.txt
> For the full list of all documentation pages, see: https://www.pubnub.com/docs/llms-full.txt


# Encryption API for Swift Native SDK

PubNub Swift SDK, use the latest version: 10.1.6

Install:

```bash
Add PubNub via Swift Package Manager or CocoaPods@10.1.6
```

PubNub Swift Native SDK includes message encryption. This page explains how to configure the `cryptoModule` and how to encrypt and decrypt data. The SDK supports 128-bit Advanced Encryption Standard (AES) and 256-bit AES in Cipher Block Chaining (CBC) mode (AES-CBC).

For general SDK configuration and initialization, refer to the [Configuration](https://www.pubnub.com/docs/sdks/swift/api-reference/configuration) page.

## Configuration

### cryptoModule configuration

To configure the `cryptoModule` to encrypt all messages/files, you can use the following methods in the Swift SDK:

```swift
import PubNubSDK

// Uses 256-bit AES-CBC encryption (recommended) with backward compatibility for legacy encryption
let pubnub = PubNub(
  configuration: PubNubConfiguration(
    publishKey: "demo",
    subscribeKey: "demo",
    userId: "myUniqueUserId",
    cryptoModule: CryptoModule.aesCbcCryptoModule(with: "pubnubenigma")
  )
)
```

```swift
import PubNubSDK

// Uses a legacy encryption mechanism (128-bit cipher key entropy) that is no longer recommended
let pubnub = PubNub(
  configuration: PubNubConfiguration(
    publishKey: "demo",
    subscribeKey: "demo",
    userId: "myUniqueUserId",
    cryptoModule: CryptoModule.legacyCryptoModule(with: "pubnubenigma")
  )
)
```

Your client can decrypt content produced by either `cryptoModule` or legacy `cipherKey`-based encryption. This allows the client to read historical messages and messages from older clients while you encrypt new messages with the stronger AES-256-CBC cipher.

:::warning Older SDK versions
Apps built using the SDK versions lower than 6.1.0 will not be able to decrypt data encrypted using the 256-bit AES-CBC cipher. Update your clients or encrypt data using the legacy algorithm.
:::

:::note SDK initialization required
Before you use encryption methods, ensure your PubNub client is configured with a subscribe key and a user ID. See the [Configuration guide](https://www.pubnub.com/docs/sdks/swift/api-reference/configuration#initialization) for setup instructions.
:::

### Relationship between cryptoModule and cipher keys

The `cryptoModule` supersedes cipher-key parameters. Passing a direct cipher key to a method (where available) overrides the configured `cryptoModule` for that operation and uses legacy AES-128 encryption. For partial encryption, create a separate `cryptoModule` instance and use it only where needed.

## Encryption methods

### Encrypt

Use this function to encrypt data.

:::note Availability
For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/swift/api-reference/configuration#cryptomodule).
:::

#### Method(s)

To `encrypt` the data you can use the following method(s) in Swift SDK.

```swift
func encrypt(data: Data)
```

| Parameter | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| data | Data | Yes |  | The `message` to encrypt. |

#### Sample code

##### Encrypt part of message

:::tip Reference code
This example is a self-contained code snippet ready to be run. It includes necessary imports and executes methods with console logging. Use it as a reference when working with other examples in this document.
:::

```swift
import PubNubSDK
import Foundation

// Initializes a PubNub object with the configuration
let pubnub = PubNub(
  configuration: PubNubConfiguration(
    publishKey: "demo",
    subscribeKey: "demo",
    userId: "myUniqueUserId"
  )
)

func encryptDataExample() throws {
  // Initialize the crypto module with a cipher key
  let cryptoModule = CryptoModule.aesCbcCryptoModule(with: "pubnubenigma")
  // The message to encrypt
  let messageToEncrypt = Data("this is message".utf8)
  // Encrypt the message
  let encryptedMessage: Data = try cryptoModule.encrypt(data: messageToEncrypt).get()
  // Proceed with encrypted message
}
```

#### Returns

##### Success

Encrypted `Data` received from the Foundation object.

##### Failure

An `Error` describing the failure.

## Decryption methods

### Decrypt

Use this function to decrypt data.

:::note Availability
For more information, refer to [Crypto module configuration](https://www.pubnub.com/docs/sdks/swift/api-reference/configuration#cryptomodule).
:::

#### Method(s)

To `decrypt` the data you can use the following method(s) in Swift SDK.

```swift
func decrypt(data: Data) -> Result<Data, Error>
```

| Parameter | Description |
| --- | --- |
| `data` *Type: Data | The `data` to decrypt. |

#### Sample code

##### Decrypt part of message

```swift
func decryptDataExample() throws {
  // Initialize the crypto module with a cipher key
  let cryptoModule = CryptoModule.aesCbcCryptoModule(with: "pubnubenigma")
  // Encrypt a message to demonstrate its decryption later
  let messageToEncrypt = Data("this is message".utf8)
  let encryptedMessage = try cryptoModule.encrypt(data: messageToEncrypt).get()
  // Decrypt data
  let decryptedData: Data = try cryptoModule.decrypt(data: encryptedMessage).get()
  // Proceed with decrypted data
}
```

#### Returns

##### Success

Initial `Data` which has been encrypted earlier.

##### Failure

An `Error` describing the failure.

## Terms in this document

* **Subscribe Key** - A unique identifier that allows your application to receive messages from PubNub channels. It's part of your app's credentials and should be kept secure.
* **User** - An individual or entity that interacts with a system, application, or service. In PubNub, a user typically refers to someone who sends or receives messages through the platform, identified by a unique user ID or username.
* **User ID** - UTF-8 encoded, unique string of up to 92 characters used to identify a single client (end user, device, or server) that connects to PubNub.